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APPENDIX : 

The Appendix includes the following items: 

- 5 pages of background, 

- 22 pages of discussion, and 

- 4 pages of a table comparing the present invention to the 
applied reference . 
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M tivation starting at page 3 "Claim Rejecti ns - 35 USC §102" and ending at page 7 
before "Claim Rejecti ns - 35 USC § 103 f the Office Acti n Summary as of 1 1/21/2003 

To make things as clear as possible the Open Standards Interconnect (OSl) model developed by 
the International Standards Organization (ISO) is important to use as a reference. For that 
purpose this document is written. 



This paper gives a brief description of the topics OSl, TCP / IP and Firewall. 

The International Standards Organization (ISO) developed a theoretical model of how networks 
should behave and how they are put together. The Open Standards Interconnect (OSl) model is 
used through the industry today to describe various networking issues. One can use it as a point 
of reference to learn how various technologies interact, where they reside, what functions they 
perform and how each protocol communicates with other protocols. 

The OSl model has seven layers: 
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A few basic concepts can be gleaned from the multi-colored diagram above. 

1 . Network-capable Applications produce DATA. 

2. Each protocol layer adds a header to the data it receives from the layer above'it. This is 
called 'encapsulation'. Encapsulated data is transmitted in Protocol Data Units (PDUs). 
There are Presentation PDU's, Ser^ : ■ PDU's, Transport PDU's etc. 

3. PDU's are passed down through the stack of layers (called 'the stack' for short) until they 
can be transmitted over the Physical layer. 

4. Any layer on one machine speaks the same language as the same layer on any other 
machine, and therefore can communicate via the Physical layer (this communication is 
represented by the ♦♦symbols). 

5. Data passed upwards is unencapsulated before being passed further up (colored bars). 

6. All information is passed down through all layers until it reaches the Physical layer 
(represented by the vertical red arrows). 

7. The Physical layer chops up the PDU's and transmits the PDU's over the wire. The 
Physical layer provides the real physical connectivity between machines over which all 
communication occurs (represented by <m 

Data from one layer is supposed to be passed down into the layer below it. In the 'real world', the 
process of encapsulation (adding a header) doesn't always occur at all layers. 



* 



4 



2 



Data passed over the Internet gets the first header from the application, then from Transport 
Control Protocol (TCP), then Internet Protocol (IP) puts in a header and passes it down. After that 
point, it's all hardware. Although IP doesn't conform completely to the model above, the model is 
still a good reference point for discussing network technologies and protocols. 



PHYSICAL LAYER 

The Physical layer provides for physical connectivity between netwo rked devices. Transmission! 
and receipt of data from the physical medium is managed at this layerj 

The Physical layer receives data from the Data Link Layer, and transmits it to the wire. The 
Physical layer controls frequency, amplitude, phase and modulation of the signal used for 
transmitting data, and performs demodulation and decoding upon receiptj 

Note that for two devices to communicate, they must be connected to the same type of physica 
medium (wiring). Ether to Ether, FDDI to FDDI etc. Two end stations using different protocols can 
only communicate through a multi-protocol bridge or a routerj 

tThe physical layer is responsible for two jobsj 

1. Communication with the Datalink layer] 

2. Transmission and receipt of dataj 



DATA LINK LAYER 

The Datalink Layer is the second layer of the OSI model. The datalink layer performs various 
functions depending upon the hardware protocol used, but has four primary functions: 

1 . COMMUNICATION with the Network layer above. 

2. SEGMENTATION of upper layer datagrams (also called packets) into frames in 
sizes that can be handled by the communications hardware. 

3. BIT ORDERING. Organizing the pattern of data bits before transmission (packet 
formatting) 

4. COMMUNICATION with the Physical layer below. 

This layer provides reliable transit of data across a physical link. The datalink layer is concerned 
with physical addressing, network topology, physical link management, error notification, ordered 
delivery of frames, and flow control. 



NETWORK LAYER 

Internet Protocol (IP), Internet Control Message Protocol (ICMP), and Internet Group 
Management Protocol (IGMP) all function at the Network layer. Outbound data is passed down 
from the Transport layer, is encapsulated in the Network layer's protocol and then sent to the 
Datalink layer for segmentation and transmission. 

Inbound data is de-fragmented in the correct order, the IP headers are removed and then the 
assembled datagram is passed to the Transport layer. 
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The Network layer is concerned with the following primary functions: 

1 . Communication with the Transport layer above. 

2. Management of connectivity and routing between hosts or networks. 

3. Communication with the Datalink layer below. 



TRANSPORT LAYER 

It is the transport layer's responsibility to see to the detection of errors, and retransmission of data 
to recover those errors or lost data. The Transport layer may use a variety of techniques such as 
a Cyclic Redundancy Check, windowing and acknowledgements. If data is lost or damaged it is 
the Transport layer's responsibility to recover from that error. 

1 . Communicate with the Session layer above. 

2. Detect errors and lost data, retransmit data, reassemble datagrams into 
datastreams 

3. Communicate with the Network layer below. 



SESSION LAYER 



The session layer tracks connections, also called 'sessions'. E.g. The session layer should keep 
track of multiple file downloads requested by a particular FTP application, or multiple tefnei 
connections from a single terminal client, or web page retrievals from a Web server j 
In the World of TCP/IP this is handled by application software addressi ng a connection to 4 
remote machine and using a different local port number for each connectionj 

[The session performs the following functions:! 

Communication with the Presentation layer above.) 

2. Organize and manage one or more connection s per application, between hosts] 

3. Communication with the Transport layer below J 



PRESENTATION LAYER 

The Presentation layer handles the conversion of data formats so that machines can 'present' 
data created on other systems. The presentation layer would handle the conversion of data in 
JPG/JPEG format to Sun Raster format so that a Sun machine can display a JPG/JPEG image. 

The Presentation layer performs the following functions: 

• Communication with the Application layer above. 

• Translation of standard data formats to formats understood by the local machine. 

• Communication with the Session layer below. 
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APPLICATION LAYER 

The application layer is the application in use by the user. This could be a web browser, an FTP, 
IRC, Telnet client other TCP/IP based application like the network version of Doom, Quake, or 
Unreal. 

The Application layer provides the user interface, and is responsible for displaying data and 
images to the user in a recognizable format. The application layers job is to organize and display 
data in a human compatible format, and to interface with the Presentation layer. 



TCP / IP 

TCP/IP (Transmission Control Protocol/Internet Protocol) is the basic communication language or 
protocol of the Internet. It can also be used as a communications protocol in a private network 
(either an intranet or an extranet). When you are set up with direct access to the Internet, your 
computer is provided with a copy of the TCP/IP program just as every other computer that you 
may send messages to or get information from also has a copy of TCP/IP. 



TCP/IP is a two-layer program. The higher layer, Transmission Control Protocol, manages the 
assembling of a message or file into smaller packets that are transmitted over the Internet and 
received by a TCP layer that reassembles the packets into the original message. The lower layer, 
Internet Protocol, handles the address part of each packet so that it gets to the right destina tion. 
Each gateway computer on the network checks this address to see where to usmmm the 
message. Even though some packets from the same message are routed differently than others, 
they'll be reassembled at the destination. 



TCP/IP uses the client/server model of communication in which a computer user (a client) 
requests and is provided a service (such as sending a Web page) by another computer (a server) 
in the network. TCP/IP communication is primarily point-to-point, meaning each communication is 
from one point (or host computer) in the network to another point or host computer. TCP/IP and 
the higher-level applications that use it are collectively said to be "st ateless" because each client 
request is considered a new request unrelated to any previous one ^Jimp^ 
EBPr^ being stateless frees 

network paths so that everyone can use them continuously. (Note that the TCP layer itself is not 
stateless as far as any one message is concerned. Its connection remains in place until all 
packets in a message have been received.) 



Protocols related to TCP/IP include the User Datagram Protocol (UDP), which is used instead of 
TCP for special purposes. Other protocols are used by network host computers for exchanging 
router information. These include the Internet Control Message Protocol (ICMP), the Interior 
Gateway Protocol (IGP), the Exterior Gateway Protocol (EGP), and the Border Gateway Protocol 
(BGP). 



FIREWALL 

A firewall is a set of related programs, located at a network gateway server, that protects the 
resources of a private network from users from other networks. (The term also implies the 
security policy that is used with the programs.) An enterprise with an intranet that allows its 
workers access to the wider Internet installs a firewall to prevent outsiders from accessing its own 
private data resources and for controlling what outside resources its own users have access to. 

Basically, a firewall, working closely with a router program, examines each network packet to 
determine whether to b'rMa'rid it toward its destination. 
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A firewall also includes or works with a proxy server that makes network requests on behalf of 
workstation users. A firewall is often installed in a specially designated computer separate from 
the rest of the network so that no incoming request can get directly at private network resources. 



REMARK APPLICANT 

[The used word "connection" in the GREEN patent might be interpreted as followsj 

b 

[•Connection" is a synonym for "forwarding' 7 ] 

ITo "close a connection" means that data is not forwarded to its destination 

m 



^Connection" means a "logical" communication sessionj 
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Motivati n starting at page 3 "Claim Rejecti ns - 35 USC §102" and nding at page 7 
bef re "Claim Rejections - 35 USC § 103 f the Office Action Summary as of 11/21/2003 



Open Standards Int rconn ct (OSI) m del 

While reading this document important is to keep in mind the Open Standards Interconnect (OSI) 
model developed by the International Standards Organization (ISO). The OSI model is also 
recognized by Green. 

Connection 

Another important subject is the definition of the word "connection". 



In telecommunication and computing in general, a connection is the successful completion of 
necessary arrangements so that two or more parties (for example, people or programs) can 
communicate at a long distance. In this usage, the term has a strong physical (hardware) 
connotation. 

A dialup (sometimes called a switched) connection is a telephonic arrangement that is set up only 
when needed, using shared, circuit-switched communication lines. A dedicated (sometimes called 
a non switched) connection is a continuous, always available connection (familiar to users of 
Digital Subscriber Line or DSL service). A leased line is a line rented from a telephone company 
that provides dedicated connection between two points (such as a headquarters office and a 
manufacturing plant). 



In computer programming, a connection is the setting up of resources (such as computer memory 
and buffers) so that a particular object such as a database or file can be read or written to. 

Typically, a programmer encodes an OPEN or similar request to the operating system thai 
ensures that system resources such as memory are set up, encodes READS and WRITES or 
similar requests, and then encodes a CLOSE when a connection is no long er needed so that the 
resources are returned to the system for other usersj 

A closely related term is session, which is sometime used to distinguish the ability to 
communicate for some duration in a logical sense. In this usage, the connection is regarded as 
the physical setup and the session is regarded as the logical setup. A session could be 
terminated and the connection maintained with the expectation of a new s ession later. 



This document 

How this document is build up. 

1 . The text of the examiner is divided up in parts. 

2. When the examiner refers to the patent of GREEN also those text parts are brought into 
this document. 

3. Where applicable comments of the applicant are written down. 
Legend 

iTexr = Words of the examiner; 

Text = Quoted text from GR EEN 6.003,084! 

Text = Comment of applicanj 
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EXAMINER 

As per claim 1, Green teaches a method for protecting data communication, traffic between 

a first communication station (11) (see Fig.2, #216; and col. 7, lines 60-62) 

and 

a second communication station (12) (see Fig. 2, #214; and col. 7, lines 60-62), . J 
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FIG. 2 

GREEN col.7, lines 60-62 

frlso shown in FIG, 2 are a client 214 and server 216 for which connections and data transfers will 
be described further belowf " 

COMMENT 1 

RCID is developed to be used in a telecom environment.) 

This means that RCID complies with given standards of the International Telecommunications! 
Union (ITU) which is a formal, worldwide telecommunications standards body ] ~ 
The ITU is a charter organization of the United Nations (UN), and is based in GenevaJ 
Switzerland] 

When a connection is made th ere is one physical AND one logical connection between TW<3 

communication stations in place ] 

When no communication is necessary there is no physical connection in place at all] 
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PIG, fax communications ITU standard 



GREEN is typically developed to be used in a network environment) _ 

When a connection is made there are always N+1 connections between N+1 communication 
stations f" 

Those connections are ALL physical.) _ 

There MI GHT be logical connections too (for instance one server with N clients, or N servers witfl 
[si clientsf 



o rinse one connection physica lly will immediately result in serious consequenc es while ALL] 
logical connections are closed tooj 



Rnr.h information security incidents a re well known and not very much appreciated as this means) 
that the corporate network IS DOWN J 



Persons of ordinary skill in the art will NEVER close communication in a physical way, becau 
this will result in the same damaged as w hen a security incident occurs like a successful Denial 
Service (DoS) attack initiated by a hacked 



EXAMINER _ 

\ in which the data is dispatched according to a data protocoi from the second commu nication 

station to thejirstcomw 

GREEN col.5, lines 29-32 

Protocol data units are interrogated for conformance to a protocol session, and optionally further! 
decoded to add additional application specific filtering] 



COMMENT 2 



RCID only monitors one type of standardized ITU protocol at the tirne j 
That protocol itself incorporates the message (for instance a fax messaged 



GREEN has to monitor much more and diverging protocols at the same timej 

Each protocol may "c arry" one or more messages (for instance different types of office! 
applications information]! 



EXAMINER 

I . .comprising the steps ofi ^ 

(I) receiving the data from the second communication station (12) in a data communica tion 
^protection de)nceJ10\j[see^J, lines 63-6 6 and col. 8 , iines 16-17)^ S 

GREEN col.7, lines 63-66 

hp ftiftewinrter security system has special TCP/IP networking modification s which allow itloi 
ccept a TCP connection request even though the data was not addressed to itj 



COMMENT 3 

RCID does not have (there is no need) such a networking modification while RCID operates in aj 
telecom environment ] 

Every physical and logical connection is made through RCIDj 

There are only two devices, one sender and one receiver, involved in the communication! . 



Sidewinder however has to deal, depending on the size of the network, with N+1 (physical) users, 
Accor ding to the specs of Sidewinder now-a-days with a maximum capacity of 25 to 40.000+ 



users 

This means a total of concurrent (logical) CONNECTIONS between 500.000 and 1.000.00011 



To close a connection physically means that ALL logical connections are closed too] 

The re sult of this is the same as the result of a positive Denial of Service attack (DoS) by s| 

i acke r J 

Such information security incidents a re well known and not very much appreciated as this meang 
that the corporate network IS DOWNj 



GREEN col.8, lines 16-17 

A client transfers transport data or FPUs to a TCP stack in the programj 



COMMENT 4 

RCID does not need nor use those kinds of stacks while RCID is operatin g in a telecom 



environment! . _ — _ 

Only two devices are communicating with each other at the time, using only one specific ITU 
standardized protocol] 



E XAMIN ER _ 

\...the protection device having 



i) a first input for connection to an Incoming c ommunica tion^^ 

from the second communication station ,Q _ 

ii) a second input for connection to the first communication station (see Fig. 2, and Fig. 3b), . . , ; 

Hi) a comparison and forwarding module connected intermediate the first input and the second t 
input and establishing a physical commun ication link betw eenj^jr^ 

(see Fig. 2, # 212 and col. 7 , lines 57- 60), . . J 
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FIG. 2 
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FIG. 3b 

GREEN col.7, lines 57-60 __ 

Computer program 210 further comprises a proxy 212 which is used to process communica tions! 
complying with different types of OSI application protocols such as the X.500 protocol shown J 



COMMENT 5 

RCID during the communication monitors one type of used ITU standardiz ed protocolj 
That protocol itself incorporates the messa ge (for instance a fax message) 
See FIG, fax communications ITU standard 

jn comply with different types of OSI application protoco ls such as the X.500 protocol GREEN 

las to compulsively act on different (application) protocols r 

Each protocol may "c arry" one or more messages (for instance different types of officel 
applications information)! 
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With reference to FIG. 2 and FIG. 3b the proxy 212 which is used to process communications 
complying with different types of OSI application protocols such as the X.5 00 protocol is NOT 



operational, nor has any direct influence on closing connections, at OSI level 1J 



EXAMINER 

..and 



iy) a memory (see Fig. 1, and coL 7 , lines 36-39 & 48-57) \ 



110 
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FIG. 1 

GREEN col.7, lines 36-39 



The current invention is an extension to the Sidewinder product. As shown in FIG. 1 generally 
110 a computer system comprises a processor 112 coupled to a random access memory, RAl 
114] 
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GREEN col.7, lines 48-57 = 

in FIG. 2, a computer program extension to the Sidewinder product is indicated generally at 210.| 
The computer program is generally stored on the disk drive 120 and run or executed by the 
)rocessor 1 12 out of RAM 114. It should be noted that disk drive 120 is used herein to represent 
various storage medium by which the computer program 210 may be stored and distributed. It 
^Iso represents a communication medium in which the program ma y be temporarily stored while! 
being transferred to computer system 1 10j 

EXAMINER _ _ _ _ „ M 

\... connected to the comparison and forwarding module, the memory unit storing characteristics of 
■a standardized communications protoco]_of first^mmun^ 

GREEN col.10, lines 40-43 ^_ 

[fhe filter maintain* a nnnfigu ration file containing what type of authentication is allowed, who isj 
Sallowed, and what possible rejection should be returned on errorj 



COMMENT 6 

n general authentication is the process of identifying an individual or system, usually based on a 
user/system name and password. In security systems authentication is distinct from authorization, 
which i s the process of giving individuals or systems access to system objects based on their 



dentityf — 3 

Authentication merely ensures that the individual or system is who he o r she claims to be, bul 
says nothing about the access rights of the individual or system] 



RCID does not use a filter which maintains a configuration file containing what type o 
auth entication is allowed, who is allowed, and what possible rejection should be returned or 
errorj 



RCID monitors the standardized ITU communication protocol] 

In case of not allowed communication RCID always closes the communicati on in a standard way! 
3V PH1SICALLY disconnecting both communication devices from each other] 

GREEN is NOT developed to close disallowed communication by physically disconnecting_at_OH 
level 1 with the result that simultaneously N+1 communication devices are disconnected] 

GREEN col. 10, lines 40-43 speaks about a possible rejection f~ 

That is very logical because physically closing down one connection means physically closing! 
ALL allowed connections, so BRINGING DOWN THE ENTIRE CORPORATE NETWORK] 

Additional GREEN makes the working of his invention useless because the firewall i s not ablelol 
functioning anymore in case closing of the communication is performed at OSl level 1 J 

Persons of ordinary skill in the art will NEVER close communication in a physical way, because 
this will result in the same damaged as w hen a security incident occurs like a successful Denial qi 
Service (DoS) attack initiated by a hacker] ™ 

GREEN FIG. 3a represents the level in the OSl model where the closing actions take placej 
It is clear that closing actions are taking place in a LOGICAL way and not at OSl level 1 J \ 
That makes sense becaus e the firewall is not able to functioning anymore in case communication 
at OSl level 1 is terminated] 
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EXAMINER _ „_ 

...the comparison and forwarding module configured to compare the standardized communication 
protocol to a data protocol of incoming data from the first input (see col.5,Jnes 3-8; coL8, Jine 66 
to ^.^Jine^iand^qqU 0Jines40'43) tz ^ 

GREEN col.5, lines 3-8 

[TCP proxies can be fitted with protocol specific filtering and appear "in-situ", with application date 
being examined and relayed in real time with only limited buffering, in contrast with the application 
gateway which would collect a full application context before relaying the data] 

COMMENT 7 

GREEN FIG. 3a represents the level in the OSl model where the closing actions take placej 
It is clear that closing actions are taking place in a LOGICAL way and not at OSl level 1] 

That makes sense becaus e the firewall is not able to functioning anymore in case communication! 
at OSl level 1 is terminated] ~ 
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GREEN col.8, line 66 to col.9, line 5 



r inally, to complete proxy processing and ensure that only specific OSI application data is being 
aassed though the session, the proxy software continually examines the OSI application level 
protocols within the data frames. For example, in one embodiment, an X.500 proxy verifies thai 
feta exchanged during the session conforms to a specific X.500 protocolj 

GREEN col.10, lines 40-43 : 

[The filter maintains a configuration file containing what type of authentication is allowed, who, is 
allowed, and what possible rejection should be returned on errorj 

COMMENT 8 

Bee comment 9 

EXAMINER 

..and 



i) to forward the incoming data to the second input when the comparison determines the data 
protocol confpjwswithi^e 

GREEN col.9, lines 41-43 

Dnce a connection is established between two devices on different network s, the prox^ 
'transparently forwards all X.500 PDUs (reguests and their replies) to the two devices! 



COMMENT 9 , 

GREEN again points to the OSI levels where forwarding of data, so "closing or opening" of 
connections are taking place. 

That makes sense because the firewall is not able to functioning anymore in case communication! 
at OSI level 1 is terminated J 

EXAMINER 

v Y.'and .... . . .. - 

ii) to physically open the communication link when the comparison determines the data protocol^ 
fails to conform with the standa rdize d communication protocol (see col.10 , lines 4Q^;_and 
co[. 12, lines 14-19); . . , 
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GREEN c 1.10, lines 40-61 = 

The filter maintains a configuration file containing what type of authentication is allowed, who is 
allowed, and what possible rejection should be returned on error. The filter component then 
processes the BIND and returns status to the communications component. Based on the status, 
the proxy may pass the BIND on to the X.500 server, or it may cancel both sessions and close 
the connections. The status to be returned on error will be configurable. Because the proxy does 
not implement OSI transport, session, presentation, ACSE or ROSE layers, it will have to 
manually build appropriate responses to reject or even possibly abort a connection which may be 
in place. For example, if the proxy has an established TCP connection and a TPO connection 
then receives a presentation P~ CONNECT request with an ACSE A-ASSOCIATE request for 
X.400 presentation context, the proxy must generate a rejection to this request, and close the 
connections. The proxy could be rude and just close the IP connection, but this is really not 
appropriate. The requester may just assume a network problem and retry the connection again. 
The appropriat e response would be to build an ACSE A-ASSOCIATE response of "rejected 
(permanently)"] 

COMMENT 10 

Se e comment 6| 

ant j ; . , 

GREEN clearly confirms that closing a connection in a physical way is not appropriate. Quote 
"...The proxy could be rude and just close the IP connection, but this is really not appropriate../ 

unquote r 

After all closing ONE connection physically means closing ALL logical connections^ 

As a result of closing the connection physically GREEN will be out of control during an amount of 
fcimej 

RCID is always in control J 

GREEN col. 12, lines 14-19 

6. The network communication session manager of claim 2 wherein the plurality of distinct layers 
includes a presentation layer, a session layer and a transport layer and wherein the connection^ 
manager rejects a remote responding e ntity by generating a response at the presentation layerj 
jthe session layer, and the transport layerf "^ 

COMMENT 11 5 : 

GREEN col . 12. lines 14-19 clearly describes the upper OSI layers where "closing actions are) 

taking place j , _ — — -— , 

That is very logical because physically closing ONE connection means closing ALL dependent 
logical connections, so BRINGING DOWN THE ENTIRE CORPORATE NETWORK] 

Additional /?FFFN *ha working nf his invention useles s because the firewall is not able td 

functioning anymore in case the above procedure is executed] 

gREEN f\n 3 a raprgftAnte the? tex/gi in the OSI modelwhere the closing actions take placej 
It is clear that closing actions are taking place in a LOGICAL way] 

Closing ^nngrtinn in a physical way is only possible in OSI layerT] 
Ml the above layers are after all dependent of OSI layer 1 1 
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DATA UNK 



PHYSICAL 



FIG. 3a 



EXAMINER 



l (ii) comparing the data protocol of the datawith the standardized communica tion protocol in the t 
data communicati on protection device (10) (s e e cj^ 

GREEN col.8, line 66 to col.9, line 5 

r inaliy, to complete proxy processing and ensure that only specific OSI application data is beind 
Dassed though the session, the proxy software continually examines the OSI application level 
protocols within the data frames. For example, in one embodiment, an X,500 proxy verifies thai 
lata exchanged during the, session conforms to a specific X.50Q protocol J 



COMMENT 12 . 

green col.l2 r lines 14*19 clearly describes the up per OSI layers where examination Is done! 
and actions e.g. "closing* connections are taking place j 

That is very logical because physically closing ONE connection means closing A LL depended 
logical connections, :$o BRINGING DOWN THE ENTIRE CORPORATE NETWORK! 

j&HHitinnai ^rppm makes the working of his invention useles s because the firewall is not able~tg 
functioning anymore in case the above procedure is executed j 

ppppM pig aa represents the level in the OSI model where the closing actions take place] 
St is clear that closing actions are taking place in a LOGICAL wayj 

r.tnsing a rtnnnectron in a physical way is only possible in OSI layer j] 
All the above layers are after all dependent of OSI layer 1 J 

EXA MINER 

^^characterized by 

(hi) forwarding data of which the data protocol complies with the standardized communicate 
protocol from the data communjcation^pm t o the first communication station 

(11) (see coL9, lines 41-43), 

GREEN col.9, lines 41-43 

pnce a conne^n is gsfohiished between two devices on different network s, the prom 
transparently forwards all X.500 PDUs (requests and their replies) to the two devices] 



COMMENT 13 
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EXAMINER 

. . .and not forwarding data of which the data protocol does not comply with the standardized 
communication protocol from the data communication protection device to the first 
communication station (see col.10, lines 40-43, lines 48-57, & lines 60-61; and col.12, lines^ 14* 
19)... 

GREEN col.10, lines 40-43 

[The filter maintains a configuration file containing what type of authentication is allowed, wholsj 
Sallowed, and what possible rejection should be returned on errorj 

COMMENT 14 

This part refers to the way user identification and user authorizat ion is being handled! 
Depending on the results a rejection should be returned on errorj 
The configuration file must always be up-to-datej 

RCID only monitors if the used protocol conforms the ITU standardized^rotg^ 
There is no configuration file which must be up-to-date what so everF 
The only possible rejection on error is closing the physical connection] 

GREEN col.10, lines 48-57 

Because the proxy does not implement OSI transport, session, presentation, ACSE or ROS^ 
layers, it will have to manually build appropriate responses to reject or even possibly abort a 
connection which may be in place. For example, if the proxy has an established TCP connection 
bnd a TPO connection then receives a presentation P™ CONNECT request with an ACSE Aj 
ksSOCIATE request for X.400 pre sentation context, the proxy must generate a rejection to this! 
^request and close the connections] 

COMMENT 15 

GREEN col .10, lines 48-57 clearly describes the upper OSI layers where "closing" actions are| 
taking placej — 

That is very logical hftr-anftft physically closing ONE connection means closing A LL dependent! 
oaical connections, so BRINGING DOWN THE ENTIRE CORPORATE NETWORK] 

AHHitinnai fiRFFN makes the working of his invention useles s because the firewall is not able td 
functioning anymore in case the above procedure is executed] 

RCID does not have to manually build appropriate responses to reject or even possibly abort a( 
connection which may be in place j 

RCID only knows one action: Close the connection physicailyj 

GREEN col.10, lines 60-61 

[The appropria te response would be to build an ACSE A-ASSOCIATE response of "rej ected 
(permanently)"J 

COMMENT 16 

iSee comment 15| 

GREEN col.12, lines 14-19 . 

B. The network communication session manager of claim 2 wherein the plurality of distinct layers 
includes a presentation layer, a session layer and a transport layer and wherein the connection 
manager rejects a remote responding e ntity by generating a response at the presentation layerj 
the session layer and the transport layerT 
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COMMENT 17 

Closing a connection in a physical way is only possible at OSl layer 1 J 
All the above layers are after all dependent of OSI layer 1 J 



GREEN clearly describes the upper OSl layers where examination is done and actions e.gJ 
"closing" connections (forwarding) are taking place j 

With great emphasis GREEN excludes the use of OSl layer 1 as a way to close connections^ 



That is very logical because physically closing ONE physical connection means closing ALB 
dependent logical connections, so BRINGING DOWN THE ENTIRE CORPORATE NETWORK^ 



Additional GREEN makes the working of his invention useles s because the firewall is not able td 
Functioning anymore in case the above procedure is executed] 



pRFFN FIG, 3a represents the level in the OSl model where the closing actions take placej 
It is clear that closing actions are taking place in a LOGICAL way J 



With great emphasis GREEN FIG. 2, FIG. 3a, FIG. 3b and FIG. 4 exclude the use of OS! layer 1| 
as a way to close a logical connection J 



That makes sense because the fir ewall is not able to functioning anymore in case communicatioiR 
at OSl level 1 is terminated indeedj ~~ 



RCID always close a connection at OSl layer 1 J 
pREEN never closes a connection at OSl layer 1 J 

EXAMINER _ ~ _ ^ 

...by physically opening the communication link within the protection device to prevent 
pommunications between the first communication station ^ 
station (12) (see col. 10, lines 43-47, 51, and 56-57) \ 

GREEN col-10, lines 43-47 



[The filter component then processes the BIND and returns status to the communications! 
Component. Based on the status, the proxy ma y pass the BIND on to the X.5Q0 server, or it may] 
bancel both sessions and close the connectionsj 



COMMENT 18 

Bee comment 17j 

GREEN col. 10, line 51 

(,.. possibly abort a connection which may be in place. For.J 



COMMENT 19 

Bee comment 171 

GREEN col.10, lines 56-57 

...generate a rejection to this request, and clos e the connections. The proxy could be rude am 
ust close the IP, but this is really not appropriate^ 
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COMMENT 20 

Bee comment 17| 

EXAMINE R 

Wis inherent that when communication links are physically opened the communication links can 
no longer transfer current thereby preventing data to be com munica ted and th erefore does not 
patentably distinguis h the invention}, 

!As {per ^c/a^ jr^reen^^c/fes of a d a ta communicati on p rote ction device (IQ^fseeJ^igJ and 
col. 7 , lines^36-47). J 

110 



PROCESSOR 



\ 

I 

COMM 



FIG. 1 

GREEN col.7, lines 36-47 ; 

The current invention is an extension to the Sidewinder product. As shown in FIG. 1 generally & 
110, a computer system comprises a processor 112 coupled to a random access memory, RAM 
114! While only a single bus 116 is shown connecting the RAM 114 and processor 112 to a 
communications port 118 and disk drive or other storage medium 120, it will be recognized by 
those skilled in the art that it represents several different busses in a standard personal computer 
architecture. The communications port represents various communications options in computer 
systems, such as ethernet cards, modems and other communication devicesj 

COMMENT 21 

See comment 17| 

ftnc j 

Also in a WIRELESS env ironment the state of affairs for GREEN and RCID will stay the same asi 

described in comment 1.7J ~~ 

EXAMI NER 

'...'arranged for protecting data communication traffic between a first communication station (ill 
] (see Fig.2, #216; and col.7, lines 60 2 62) and a^ 
#214 ; and col. 7, lines 60-62), J[~ 



RAM 



DISK 
DRIVE 



14 



214 

i 



X.500 i 
CUENT (QUA) ' 



ACSE/ROSE 



OSt PRESENTAT 



OSl SESSION 



09 TRANSPORT 



-~ OSl )C500 OAP REPLY— 

®OSI X.500 OAP BIND — 
SRC: QUA DEST: DSA 

® 

— OS T_CONNECT _REPLY — 

®OSI T.COHNECT-REQUEST 

— SRC: DUA DEST: DSA * 



TCP/TP J TCP_CONNECT_REPLY^ 

v © TCP JX)NNECTJ*EQUEST 
\— SRC: DUA DEST: DSA 



210 



212 



OSl UN-ENCODING 
ROUTINES (TRANSPORT 
SESSION, PRESENT., 
ACSE/ROSE 



&500 
PROXY 



OSl X.500 OAP REPLY — 

® OSl XJ5O0 OAP BIND — 
SRC: DUA DEST: DSA 

® 

— OSl T_CONNECTJ«PLY - 

®OSI T_CONNECT_REOUEST 
SRC: DUA DEST: OSA — 



K TCP/IP | Ljj^pJ * TCPJttNNECTJKPlY^ 

® TCP^CONNECTJ^EQUEST 
v — SRC: SWDER DEST: DSA" 



216 



i X.500 , 
^SERVER (DSA) J 



ACSE/ROSE 



09 PRESENTA1 



OS) SESSION 



OSl TRANSP0R1 



J TCP/IP 



FIG. 2 



GREEN col.7, lines 60-62 

!i§8 




EXAMINER 



\...data being dispatched according to a data protocol from the second com munication stationjo 
the first communication station ^ cd.5,Jnes^^2)^ 




EXAMINER _ _. , 

\...ihe data communication protection device comprising: a first input for connection to an 
incoming communication line receiving the data communication from the second communication 
station (see Fig. 2, and Fig.3b). '^a^e^ndjnf>^jgr connecti on to the first communicatiojistatipjx 
(see H&2 l jtnd_RgJfo) m i 1 J 
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®0S X.500 DAP BIND 
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— SRC: DUA DEST: DSA * 

— - TCP_CONNECTLREPLY 

® TCP_CONNECT_REQUEST 
.— SRC: DUA OEST: DSA 
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OSI UN- ENCODING 
ROUTINES (TRANSPORT 
SESSION, PRESENT., 
ACSE/ROSE 



5C500 
PROXY 



-~ OS X.500 DAP REPLY— 

® OS )C500 DAP BIND 
SRC: DUA DEST: DSA 

©OS T_CONNECTJ«QUESr 
SRC: DUA DEST: OSA — 



^ TCP/iP | I TCP/IP ,f ^ TCPJttNNECTJiEPLY^ 

® TCP_CONNEGT_R£QUEST 
v" - SRC: SWDER DEST: OSA" 
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SERVER (DSA) J 
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J TCP/IP 



FIG. 2 
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CONTROL 




CONTROL 


PDUs 




RELAY 



I 



PDUs 



STACK 



PDUs 



STACK 



SERVER 



FIG. 3b 



EXAMINER 

...a comparison and forwarding module connected intermediate the first input and the second 
input and establishing a physical communication link between ^ 
(see Fig J, #212 andcolj, lines 57-60);.. j 
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®OS1 )C500 DAP BIND 
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— OS) X.500 DAP REPLY— 
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SRC: DUA DEST: DSA 
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— SRC: DUA DEST: OSA — 
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ACSE/ROSE 
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OS) SESSION 



OSl TRANSPORT 



J TCP/IP 



FIG. 2 

COMMENT 24 

With great emphasis GREEN FIG. 2 excludes the use of OSl layer 1 as a way to close a logical 

connection j 

That makes sense because the fir ewall is not able to functioning anymore in case communication! 
at OSl level 1 is terminated indeed J 



GREEN col.7, lines 57-69 ( 

Computer program 210 further comprises a proxy 212 which is used to process communications! 
complying with different types of OSl application protocols such as the X.500 protocol shown] 
klso shown in FIG. 2 are a client 214 and server 216 for which connections and data transfers win 
be described further below. The Sidewinder security system has special TCP/IP networking 
friodifications which allow it to accept a TCP connection request even though the data was noi 
addressed to it. The Sidewinder can then verify the data and establish another independent 
[session with th e real destination device using the destination address specified within the senders! 
original reguestj 

COMMENT 2S{ 

Quote "...and establish another independent session with..." unquote J 

hrffn riftsnrihes the setup of a LOGICAL communication path in case a re quest is approvedj 
it goes without saying that such build connection is closed in a logical way toj 

With great emphasi s GREEN col.7, lines 57-69 exclude the use of OSl layer 1 as a way to closel 
a logical connectionj 

That makes sense because the fir ewall is not able to functioning anymore in case communication 
atOSi level 1 is terminated indeedj 

EXAMINER _ _ . _ 

ZSO^ ajmeWPIY ( see F & 1 > and coL TJh4§ 36-39 & 48-57). . . 
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PROCESSOR 
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FIG. 1 

GREEN col.7, lines 36-39 

The current invention is an extension to the Sidewinder product. As shown in FIG. 1 generally at 
110, a computer system comprises a processor 112 coupled to a random access memory, RAM 
114j 

GREEN col.7, lines 48-57 

}n FIG. 2, a computer program extension to the Sidewinder product is indicated generally at 21 OJ 
[The computer program is generally stored on the disk drive 120 and run or executed by thd 
processor 1 12 out of RAM 114. It should be noted that disk drive 120 is used herein to represent 
various storage medium by which the computer program 210 may be stored and distributed. Ilj 
also represents a communication medium in which the program may be temporarily stored whilQ 
being transferred to computer system 110j 

EXAMINER . 

i. ~. connected to the comparison and forwarding module, the memory unit storing characteristics of 
a standardized communication protocol of first communication device (see col. 10, lines 40-43),, 
the comparison and forwarding module configured to compare the standardized communication 
protocol to a data protocol of incoming data from the first input (see col. 5, lines 3-8; col. 8, line 66 
to col. 9, line 5; and col. 10, lines 40-43), and. . . 

GREEN col. 10, lines 40-43 ^ 

[The filter maintains a configuration file containing what type of authentication is allowed, who ig 
allowed, and what possible rejection should be returned on errorj 

COMMENT 26 

RCID does not use a filter which maintains a configuration file containing what type ol 
authentication is allowed, who is allowed, and what possible rejection should be returned or 
error j 

RCID monitors the standardized ITU communication protocolj 

GREEN col. 5, lines 3-8 

[TCP proxies can be fitted with protocol specific filtering and appear "in-situ", with application data 
being examined and relayed in real time with only limited buffering, in contrast with the application 
bateway which would collect a full application context before relaying the dataj 



COMMENT 27 

RCID does not use a filter which maintains a configuration file containing what type ol 
authentication is allowed, who is allowed, and what possible rejection should be returned on 
error j 

RCID monitors the standardized ITU communication protocolj 
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GREEN col.8, lin 66 toe 1.9, line 5 

Finally, to complete proxy processing and ensure that only specific OSI application data is beind 
passed though the session, the proxy software continually examines the OSI application level 
protocols within the data frames. For example, in one embodiment, an X.500 proxy verifies thai 
data exchanged during the session conforms to a specific X.500 protocol] 

COMMENT 28 , 

GREEN again points to the OSI , levels where forwarding of data, so "closing or opening" oj 
connections are taking placej 

That makes sense becaus e the firewall is not able to functioning anymore Kcase communicatiQi^ 
at OSI level l is terminated] 

GREEN col. 10, lines 40-43 ^ 

The filter maintains a configuration file containing what type of authentication is allowed, who is 
allowed, and what possible rejection should be returned on error] 

COMMENT 29 _ 

RCID does^ not use a filter which maintains ja configuration file ^ contaiining what type ? of 
authentication is allowed, who is allowed, and what possible rejection should be returned \or{ 
error j 

RCID monitors the standardized ITU communication protocol! 

EXAMINE R 1^ 

i) to forward the incoming data to the second input when the comparison determines the data 
prot ocol conforms with th e sta ndardiz ed co mmunications protocol (see col.9 , line s 41-43 )..[ 

GREEN col.9, lines 41-43 

nnrp a r^nnpntinn is established between two devices on different network s, the proxy 
transparently forwards all X.500 PDUs (reguests and their replies) to the two devices] 

COMMENT 30 - 

GREEN again points to the OSI levels where forwarding of data^so ^losing or opening" jol 
connections are taking place! 

That makes sense because the firewall is not able to functioning anymore in case commuinicatiQd 
at OSI level 1 is terminated J 

EXAMINER 

f. . .and _. _ 

ii) to physically open the communication link when the comparison determines the data protocol 
[ fails to conform with foe^andardjzed^gmmuw col. 10, li nes 40-61; and 
pol.12, line s 14-1 9)! ~ 

GREEN col. 10, lines 40-61 ; 

[The filter maintains a configuration file containing what type of authentication is allowed, who is 
allowed, and what possible rejection should be returned on error. The filter component then 
processes the BIND and returns status to the communications component. Based on the status. 
The proxy may pass the BIND on to the X.500 server, or it may cancel both sessions and close 
the connections. The status to be returned on error will be configurable. Because the proxy does 
'not implement OSI transport, session, presentation, ACSE or ROSE layers, it will have to 
fnanually build appropriate responses to reject or even possibly abort a connection which may be 
in place. For example, if the proxy has an established TCP connection and a TP0 connection 
then receives a presentation P- CONNECT request with an ACSE A-ASSOCIATE request for 
k.400 presentation context, the proxy must generate a rejection to this reguest, and close the 
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[connections. The proxy could be rude and just close the IP connection, but this is really not 
appropriate. The requester may just assume a network problem and retry the connection again. 
The appropriat e response would be to build an ACSE A-ASSOCIATE response of "rejected 
(permanently)".! 

COMMENT 31 

[Se e comment 61 

an< j 

GREEN clearly confirms that closing a connection in a physical way is not appropriate. Quote 
"...The proxy could be rude and just close the IP connection, but this is really not appropriate../ 
unquote r 

After all closing ONE connection physically means closing ALL logical connections] 

As a result of closing the connection physically GREEN will be out of control during~an amount oj 
time] 

RCID is always in control] 

GREEN col. 12, lines 14-19 

5. The network communication session manager of claim 2 wherein the plurality of distinct layers! 
includes a presentation layer, a session layer and a transport layer and wherein the connection 
manager rejects a remote responding e ntity by generating a response at the presentation layerj 
be session layer, and the transport layerj 

COMMENT 32 • 

GREEN col . 12, lines 14-19 clearly describes the upper OSI layers where "closing" actions arej 
taking place] 

[That is very logical because physically closing ONE connection means closing AUjJhependenj 
logical connections, so BRINGING DOWN THE ENTIRE CORPORATE NETWORK] 

Additional GREEN makes the working of his invention useles s because the firewall is not ablelcl 
functioning anymore in case the above procedure is executedi 

RCID does not have to manually build appropriate responses to reject or even possibly abort a| 
connection which may be in place ] ' 
RCID only knows one action: Close the connection physically] 

EXAMINER _ 

As per claims 20, Green further teaches wherein the standardized c ommunica tion proto col is 
other than a T CP/IP protocol compon ent (see col. 11, lines 44-47)\ 

GREEN col.11, lines 44-47 ^ 

In addition, further communication proto cols may als o be used, and the claims should not bej 
limited to those that have been described] 

EXAMINER 

l As per claims 11, 13, 15, 17, and 19, Green further teaches wherein when the comparison and 
forwarding module opens the communication link, a data f ile of the incoming da ta is stored in the 
memory (see col A, li n es 31-33 & 48-6 1 andc ol.5, line 6)j 

GREEN col-4, lines 31-33 

[The firewall may have to buffer large am ounts of data before being able to relay the data to thei 
lother independent application association] : 
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GREEN c I.4, lines 48-61 

f a proxy were to operate at a data link layer, referred to as a MAC layer, it would capture! 
Ethernet frames and examine the addresses in the MAC header, and filter the payload portion (Ih 
datagrams) to determine Internet Protocol IP addresses. Higher layer filtering would be infeasible 
because data would have to be buffered and reassembled in order to gain enough context, and 
the semantics of TCP are such that only limited number of frames could be buffered and 
examined before it would become necessary to send them in order to receive more. So if only a[ 
partial security context has been determined when the buffer threshold was reached, the dataj 
would have to either be disc arded or sent without full validation-in either case, an unacceptable! 
alternative for OSI application.! 

GREEN col. 5, line 6 

L.time with only limited buffering, in contrast with the application ... 

COMMENT 33 

GREEN again points to the OSI levels where forwarding of data, so "closing or opening" o< 
connections are taking placej 

That makes sense becaus e the firewall is not able to functioning anymore in case communication 
at OSI level 1 is terminatedj 
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With RCID protected fax machines.. 
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Device Device 




Physical Medium 



RCID 

• In the above presented picture device A and device B both represent one device 
indeed. 

• RCID connects and disconnects at OSI level 1. 

• Disconnecting at OSI level 1 is the goal of RCID. 

• Disconnecting at OSI level 1 will result in a save and desired state which will prevent 
the loss of property (files, proprietary information, etc.) 

GREEN 

• In the above presented picture device A and device B both represent N+l devices. 

• GREEN "connects" and "disconnects" (setting up sessions) not at OSI level 1 . 

• Disconnecting different from OSI level 1 is the goal of GREEN. 

• Disconnecting at OSI level 1 will immediately result in bringing down the complete 
corporate network which will lead to loss of property (files, proprietary information, 
etc.) 



RCID 


Gr en 


Protection DEVICE vs prot ction Application(s) 


Controls the connection to the device. 

• It is to the full advantage of the 

protected device when during a security 
event the connection will be broken 
physically. 


Controls the connection to one or more 
applications 

• It is to the full advantage of the specific 
protected application when during a 
security event the connection will be 
broken logically. 

• Breaking the connection physically will 
inevitable lead to a break down of ALL 
approved connections. Thus creating 
an information security incident by 
Green itself 

See for instance 
fig2/fig3a/fig 3b /fig 4 
Col 5 sentence 17 


Judgement 


Evaluates the protocol as a whole. 


Evaluates only the Protocol Data Units 
( PDID of which rules are given in the 
access control list. 

See for instance 
Fig 3b 

Col 8 sentence 15-17 


Range off kind of protocol 


Does NOT limit the protection with respect 
to protocols based on the TCP-IP layer. 


LIMITS the protection with respect to 
protocols based on the TCP-IP layer alone. 

See for instance 

Col 8 sentence 15-17 

Col 9 sentence 66-Col 10 sentence 3 

Col 11 sentence 1-2 

Col 12 sentence 32-36 

Col 14 sentence 61-64 


Guards on 


th basis of 



Evaluates if a protocol is an approved 
international standard. 



• The system administrator does not need 
to configure the RCID device. 



• The device to protect is ALLWAYS 
safeguarded by RCID. 



• RCID can be installed "out of the box 



Evaluates the Protocol Data Units (PDU) 
of which rules are given in the access 
control list . 

• For the proper working of Green, the 
system administrator needs to 
configure the Access Control List 
(ACL) and keep that ACL up to date. 

• The applications to protect are NOT 
always safeguarded by Green eg when 
the ACL is not configured, not complete 
or not up to date. 

• Green can not be installed "out of the 
box " and demands that a mandatory 
Access Control List must be configured. 

See for instance 
Col 5 sentence 22, 27, 39-45 
Col 10 sentence 9-12 
Col 13 sentence 7, 47 



3 



Disconn ction of the connection 


When a security event occurs, the 


When a security event occurs, the 


connection will be broken PHYSICALLY 


connection will be broken LOGICALLY 


ALLWAYS 


ALLWAYS 




This TS inherent to the design of RCID 


• This is NOT inherent to the intention 






and design of Green. 


• 


/f inevitable that NO communication 


• It is inevitable that NO communication 




is possible at all when the connection is 


is possible at all when the connection is 




P HYS7CA T TY broken 


PHYSICALLY broken, eg all approved 






connections also will be terminated. 


• 


The special design of RCID provides 


• Because of the design of Green, Green 
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is not able to function as intended 
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when the connection will be physically 




physical way. 


broken. 
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• It is emphasized that the working of 




RCID enforces to break the connection 


Green enforces to break the connection 




physically at all times a security breach 
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In the event of a security breach no 


• In the event of a security breach no 




connection is necessary at all. 


connection is necessary for that 
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be down completely. 
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See for instance 






Fig 3a /3b 






Col 5 sentence 24-26, 39-45 






Col 6 sentence 17-20 






Col 8 sentence 17-25 






Col 10 sentence 57, 60 
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Col 12 sentence 8, 17-20, 39-44 


Relation 


There is an one on one (1 on 1) relation 
Device RCID Device 

There is no hierarchy at all. 


There is an one on "n" (1 on n) relation 
Device Green ^ Devices 

There is hierarchy present. 

(one server and one or more clients) 

See for instance 
fig2/fig3a/fig 3b /fig 4 
Col 1 sentence 5-7 



